Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, a mass assignment vulnerability exists in the tool update endpoint of FlowiseAI. The endpoint allows authenticated users to modify server-controlled properties such as workspaceId, createdDate, and updatedDate when updating a tool resource. Due to missing server-side validation and authorization checks, an attacker can manipulate the workspaceId field and reassign tools to arbitrary workspaces. This breaks tenant isolation in multi-workspace environments. This issue has been patched in version 3.1.2.

According to its banner, the version of Flowise running on the remote host is < 3.1.2. It is, therefore, affected by multiple vulnerabilities :

- An hardcoded CORS wildcard on TTS endpoint enables abuse from any webpage

- An RCE through Flowise MCP

- A Mass Assignment in Chatflow Update Endpoint

- A Mass Assignment in Tool Update Endpoint

- A Mass Assignment in Assistant Update Endpoint

- A Mass Assignment in Variable Update Endpoint

- A Mass Assignment in PUT /api/v1/user

- An Authenticated Host RCE via POST /api/v1/node-custom-function

- A Cross-Workspace Chatflow Disclosure via chatflows/apikey Endpoint

- A Credential Data Leak

- Vector Store No Permission Checks

- CustomTemplate create+update mass-assignment

- Assistant create+update mass-assignment allows cross-workspace assistant takeover

- DatasetRow create+update mass-assignment

- Dataset create+update mass-assignment

- Evaluation create+update mass-assignment

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version
    3.1.2, a mass assignment vulnerability exists in the tool update endpoint of FlowiseAI. The endpoint
    allows authenticated users to modify server-controlled properties such as workspaceId, createdDate, and
    updatedDate when updating a tool resource. Due to missing server-side validation and authorization checks,
    an attacker can manipulate the workspaceId field and reassign tools to arbitrary workspaces. This breaks
    tenant isolation in multi-workspace environments. This issue has been patched in version 3.1.2.
    (CVE-2026-42862)

ID	Name	Product	Family	Severity
115278	Flowise < 3.1.2 Multiples Vulnerabilities	Web App Scanning	Artificial Intelligence	critical
441884	SCA: security update for flowise (GHSA-x5v6-pj28-cwwm)	Tenable Cloud Security	SCA Checks	high
441884	SCA: security update for flowise (GHSA-x5v6-pj28-cwwm)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2026-42862

high

Tenable Plugins

critical

high

high